                             :value #{:digital-signature :key-encipherment}}
                            {:oid "2.5.29.14"
                             :critical false
-                            :value subject-pub}]]
+                            :value subject-pub}
+                           {:critical false
+                            :oid      "1.3.6.1.4.1.34380.1.1.1"
+                            :value    "AAAA-BBBB-CCCC-DDDD"}]]
         (is (= exts exts-expected))))))

        (is (= exts exts-expected))))

    (testing "only puppet extensions are copied from CSR to cert"
      (let [csr-exts [(utils/subject-dns-alt-names ["onefish"] false)]
            csr      (utils/generate-certificate-request
                       subject-keys subject-dn csr-exts)
            exts (create-agent-extensions csr issuer-pub)

(ns puppetlabs.master.certificate-authority-test
  (:import (java.io StringReader ByteArrayInputStream)
           (java.security MessageDigest))
  (:require [puppetlabs.master.certificate-authority :refer :all]
            [puppetlabs.trapperkeeper.testutils.logging :as logutils]
            [puppetlabs.certificate-authority.core :as utils]
